🤖 AGENTS.md: todo-rust

The one rule: the page works with JavaScript off. Every action is a plain HTML form POST answered with a 303. JavaScript only makes the same requests without a page load; it never adds behaviour the server lacks.

Tenancy

• One instance for the whole app (todo-rust.bfj.oncarlos.com, one SQLite file).
• Each visitor's list is kept separately by an anonymous cookie (todo_list: 128 random bits, hex, HttpOnly; SameSite=Lax; Path=/, Secure over https). Every query is scoped to the list that cookie names; an id from another list answers 404.
• No sign-in. Losing the cookie loses the list.
• Trust class C. Todo text is stored as plain text in SQLite. That is a deliberate choice for a demo app with anonymous lists, written down here so nobody mistakes it for an oversight.

Working here

• Work only in apps/rust/. BRIEF.md and CONTRACT.md at the repo root are binding.
• Servers bind 127.0.0.1 only. Scratch goes in mktemp -d -p "$TMPDIR".
• Migrations only add (src/db.rs, keyed by PRAGMA user_version).
• Commits end with a Co-Authored-By: trailer naming the model.